The invention disclosed herein relates generally to performing storage operations through a firewall. More particularly, the present invention relates to providing a limited number of ports in a firewall for performing secure storage operations between components in a computer network.
Firewalls reside between components in a computer network and generally function to prevent unauthorized access to the network by evaluating which communications should be allowed to pass between the firewall's network and other networks or network components. A firewall thus divides a network into two parts: a friendly/secure side and a hostile side, wherein computers inside the firewall on the friendly side are protected from computers outside the firewall on the hostile side.
A firewall evaluates whether network traffic such as data streams, control messages, application data, communications packets, and other data meets specified security criteria and should be allowed to pass between components of the network. Data that does not meet the security criteria is generally discarded or otherwise blocked from passing between components. A firewall may comprise hardware elements, software components, or any combination thereof. Exemplary firewalls include packet filters, bastion hosts, application or circuit-level gateways, and proxy servers.
One method used by firewalls to prevent unauthorized communications is to restrict network communications to specified ports. A port is generally used by TCP/IP. UDP, and other communication protocols to represent the logical endpoint of a particular connection. For example, HTTP traffic associated with a particular computer might be routed through port 80. Various programs, services, and other applications on a computer often run listening processes for network traffic directed to a particular port. Limiting network communications to specific ports and closing all unused ports generally reduces the risk of unauthorized access to a computer since these programs, services, and other applications could be compromised or otherwise exploited by a hacker to gain access to the computer.
Firewalls provide additional security by timing out network sessions beyond a specified time period. Thus, ports do not remain unnecessarily open in the event of network connection failures, slowdowns, or other events which might create vulnerabilities. For example, any network sessions that become idle beyond a preconfigured timeout period are automatically disconnected without warning. Further, after making a new connection, a first packet must be sent within a timeout period or the connection is also disconnected.
Existing storage management systems, however, use many thousands of ports to conduct storage operations through a firewall. Typically, these systems keep large sets of known ports open during backups and restores. Each of the streams of data sent as part of a backup, a restore, or other storage operation must have a port open in the firewall to pass the data. For example, data pieces come through multiple streams, control signals come through other streams, status messages come yet other streams, etc. The head end (sender) and tail end (receiver) of existing systems, however, do not know which ports all of the data is coming through, so they generally reserve large blocks of ports in the firewall to accommodate the various streams of data that they anticipate. Furthermore, these systems also must keep many ports open since slow network connections and other factors may cause a connection to timeout and the firewall to close an intended port thus requiring data to be resent to another port. Opening thousands of ports in this manner, however, renders a firewall more like a switch than a firewall and severely compromises network security.
There is thus a need for systems and methods which reduce the number of open ports required in a firewall to perform storage operations in a computer network.